by Kastro
Paper/Archive/CVE-2024-20738

CVE-2024-20738

Adobe Adobe Framemaker Publishing Server — Adobe FrameMaker Publishing Server Authentication Bypass Vulnerability | CVE-2023-44324 bypass

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 64.6.646 × 2012.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Adobe FrameMaker Publishing Server versions 2022.1 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass authentication mechanisms and gain unauthorized access. Exploitation of this issue does not require user interaction.

Affected

ProductAffectedFixed inSource
Adobe Framemaker Publishing Server≤ 2022.1–CNA
framemaker_publishing_server≤ 2022.1–CISA-ADP
framemaker_publishing_server≤ 2020–CISA-ADP

Scores by source

adobe (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

advisoryhelpx.adobe.com/security/products/framemaker-publishing-server/apsb24-10.html